[blackd0t]

SerpentFly, can you think of any idea how do personal firewalls know which process sent a packet when it detects network transfer?

[blackd0t]

Hmm…

I have always used system wide dll inject, but is there really any reason to do it when you have such privilleges on the machine? I see that things can be done easier by hijacking APIs in Kernel-Mode. (i’m still a n00b in that matter)

[blackd0t]

Thanks for the reply!

You mean that it’s possible to hook GetCommandLine() API in malware program to make firewall think it’s looking at something else? How does the firewall know which packet belongs to which process?

If such thing can be done, why the only published method to bypass personal firewalls was to inject malware code into the other “privilleged” process?

[Author]

Posts